Privacy Policy

This notice explains the current website, intake, assistant, and client-portal data flows. A signed project agreement may add service-specific terms.

• Public forms: name, email, optional mobile phone, business name, website, location/service area, trade, current tools, bottleneck, desired outcome, selected services, and consent records.
• Portal access requests: the identity, business, contact, and access context you choose to submit.
• Public assistant questions and authenticated portal messages or uploads when you use those features.
• Security and request data processed by hosting, network, abuse-prevention, and Cloudflare Turnstile services.
• Scheduling details you choose to submit through our self-hosted booking widget.

• Respond to your request, verify access, and provide related follow-up.
• Scope, build, test, support, and document an engagement.
• Use automated workflows and AI to summarize, classify, draft, and prepare internal work. Human approval remains required for consequential external actions.
• Operate tenant-isolated accounts, the client portal, security controls, audit records, and backups.
• Protect the form and site from automated abuse and coordinate an appointment when you use the scheduler.

Waypoint is local-first where practical. The public website is hosted and protected through Cloudflare; Turnstile verifies public submissions; scheduling is handled by our self-hosted booking widget; and email, messaging, payment, social, CRM, hosting, and AI providers may process information when a client-approved integration or deployment uses them. Since 8 September 2026 the public website also loads the Meta Pixel, which sends Meta the page you viewed, the referring page, your IP address, and browser and device information, and sets Meta advertising cookies. It is used to measure our own advertising and to avoid re-showing ads to people who have already visited. It runs on the public marketing site only. See the Cookie Policy for what it collects and how to switch it off. The active AI path may be local Ollama, a configured Cloudflare AI endpoint, or an owner-enabled external fallback. Do not enter passwords, API keys, payment or bank details, government identifiers, health information, classified or controlled information, or another person’s confidential data in public chat or forms.

We retain information only as needed for the request, account, engagement, security, audit, legal, and financial purposes that apply. Retention may differ by record type and provider. To request access, correction, portability, or deletion, email hello@waypointautomationconsulting.com with enough information for us to verify the request; do not send passwords or secrets. We may retain minimum suppression, consent, financial, and tamper-resistant audit records where required or reasonably necessary to honor opt-outs, meet legal obligations, or defend claims. We will explain any refusal and available appeal path where applicable.

We honor Global Privacy Control (GPC) signals. When a browser sends the Sec-GPC: 1 header, our portal edge logs the opt-out and treats it as a do-not-sell / do-not-share request under applicable state law. No manual opt-out is required when GPC is active.

We do not sell personal data or use the public site for targeted advertising based on the current code review. We do not knowingly solicit children under 13. We may update this notice when the data flows or services change and will post the current version here. This page is not legal advice and does not replace a signed data-processing or project agreement where one is required.

SMS / Text Messaging

When you provide your mobile phone number on an intake form or through the client portal and consent to receive SMS messages, we may send transactional and follow-up text messages related to your request or engagement. Message frequency varies (typically 1–4 messages per request). Message and data rates may apply. Reply STOP to opt out at any time; reply HELP for assistance. Opt-out requests are processed immediately and recorded in our suppression list. We do not share SMS opt-in data with third parties for marketing purposes. SMS consent is not a condition of any purchase or service. We retain minimum suppression and consent records as required to honor opt-outs and meet legal obligations.